In early 2024 a shadowy cyber‑crime collective announced that it had compromised the data of millions of users of Revolut, the UK‑based financial‑technology platform that offers banking, currency exchange and cryptocurrency services. The group, which has not publicly identified itself beyond a moniker used on underground forums, claimed to have exfiltrated a trove of personal and financial information and then set a deadline of 24 hours for Revolut to hand over a ransom of three million dollars, payable in the privacy‑focused cryptocurrency Monero (XMR). In addition to the monetary demand, the attackers warned that they would put the stolen data up for sale on dark‑web marketplaces if their conditions were not met, specifically targeting customers who hold significant amounts of crypto assets in their Revolut accounts. The threat was broadcast through a series of posts on a well‑known hacking board, where the perpetrators posted screenshots of what they said were excerpts from the compromised database.
The images displayed partial account numbers, email addresses, phone numbers and, most alarmingly, records of cryptocurrency wallets linked to Revolut users. The attackers emphasized that the data could be used for further fraud, identity theft, or to facilitate illicit transactions, thereby increasing the pressure on the financial‑services company to comply with their demands. Revolut’s official response was swift but measured. In a public statement the company said it had not received any direct contact from the threat actors and that it was working with law‑enforcement agencies and independent security experts to investigate the alleged breach.
The firm reiterated its commitment to safeguarding customer data and noted that its security architecture includes multiple layers of encryption, tokenisation and continuous monitoring. Revolut also reminded users that it never asks for private keys or wallet passwords via email or any other channel, and urged customers to be vigilant for phishing attempts that might exploit the current situation. Cyber‑security analysts who examined the claim noted several red flags that suggest the incident could be a classic extortion‑by‑leak scenario rather than a genuine data theft.
First, the screenshots posted by the group were low‑resolution and appeared to have been edited, raising doubts about their authenticity. Second, the demand for payment in Monero—chosen for its anonymity features—aligns with a pattern observed in other recent ransomware and data‑leak extortion cases, where criminals prefer privacy‑coins to avoid tracing.
Regardless of the veracity of the breach, the episode highlights a broader trend in the financial technology sector: as more traditional banking services integrate cryptocurrency functions, they become attractive targets for threat actors seeking to exploit the high‑value assets stored in digital wallets. Revolut, like many of its peers, offers a seamless interface for buying, selling and holding crypto, but this convenience also expands the attack surface.
Hackers may focus on the underlying APIs, third‑party integrations, or even the onboarding processes that collect personally identifying information (PII) from users. The incident also underscores the importance of robust incident‑response planning. Companies that handle both fiat and crypto must be prepared to coordinate with multiple regulatory bodies, including financial conduct authorities, data‑protection agencies and cyber‑crime units.
In the United Kingdom, the Financial Conduct Authority (FCA) and the Information Commissioner's Office (ICO) would likely be involved in any formal investigation, especially if personal data of EU citizens is at risk under GDPR. From a user perspective, the warning serves as a reminder to adopt best practices for protecting digital assets. Customers should enable two‑factor authentication (2FA) on all accounts, use strong, unique passwords, and consider storing large crypto holdings in hardware wallets rather than on exchange‑linked platforms. Regularly reviewing account activity, setting up transaction alerts, and being cautious of unsolicited communications claiming to be from support teams can also reduce the risk of falling victim to social‑engineering attacks.
In the weeks following the announcement, no evidence emerged that the stolen data had been posted online or that any ransom payment was made. Law‑enforcement agencies in the UK and the US issued statements indicating they were monitoring the situation and had opened a joint investigation. Some cybersecurity firms began scanning dark‑web forums for any listings that matched the description provided by the attackers, but so far no credible listings have been identified. The episode may have longer‑term implications for how fintech companies approach crypto integration.
Industry observers predict that regulators will push for clearer guidelines on data protection, risk assessment and customer disclosure when offering crypto services. Enhanced transparency about how user data is stored, encrypted and accessed could become a competitive differentiator, as customers increasingly demand assurance that their financial and personal information is shielded from both cyber‑criminals and internal misuse.
In summary, a group claiming responsibility for a massive data breach at Revolut demanded a $3 million ransom in Monero and threatened to sell the information of customers with sizable crypto holdings. Revolut denied any direct contact, launched an internal investigation, and called on authorities to intervene.
While the authenticity of the breach remains unconfirmed, the incident serves as a stark reminder of the evolving threat landscape facing fintech firms that blend traditional banking with cryptocurrency services. Users are urged to adopt strong security habits, stay alert to potential phishing schemes, and consider the safest ways to store their digital assets. The situation continues to develop, and both the financial and cybersecurity communities are watching closely for any further disclosures or actions by the alleged perpetrators.